The VAPT Process, Step by Step: How a Pentest Works | Osto<\/title>\n<meta name=\"description\" content=\"The VAPT process step by step: scoping, reconnaissance, scanning, controlled exploitation, risk analysis, reporting, and remediation with a retest.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">A professional VAPT is a disciplined sequence, not a single scan. Here is what happens at each stage, from defining scope to proving that your fixes actually worked.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>8 min read<\/span><span class=\"dot\"><\/span><span>Security Testing<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>A VAPT runs through defined stages: scoping and rules of engagement, reconnaissance, scanning to find weaknesses, controlled exploitation to prove real risk, then risk analysis, reporting, and remediation with a retest to confirm fixes.<\/p>\n <p>The value is in the whole sequence. Scanning finds candidates, exploitation proves impact, and the report translates it into prioritised fixes. A good VAPT ends with a retest that verifies the issues are actually closed, not just a document.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#matters\">Why the process matters<\/a><\/li>\n <li><a href=\"#stages\">The six stages<\/a><\/li>\n <li><a href=\"#detail\">Each stage explained<\/a><\/li>\n <li><a href=\"#retest\">The retest that closes the loop<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"matters\">Why the VAPT process matters<\/h2>\n <p>The difference between a genuine VAPT and a superficial scan is the process behind it. A real engagement follows a structured methodology so that nothing important is missed, findings are proven rather than guessed, and the output is something you can act on. Understanding the stages helps you tell a serious test from a checkbox exercise, and helps you get real value from the engagement rather than just a PDF.<\/p>\n\n <div style=\"background:linear-gradient(135deg,#0e1444,#1c267a 55%,#242f86);border-radius:20px;padding:34px 34px 30px;margin:30px 0;box-shadow:0 18px 50px rgba(14,20,68,.28);position:relative;overflow:hidden\">\n <div style=\"position:absolute;top:-50px;right:-40px;width:260px;height:260px;background:radial-gradient(circle,rgba(58,70,192,.45),transparent 68%);pointer-events:none\"><\/div>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#aeb6ee;margin-bottom:6px\">A disciplined sequence<\/div>\n <div style=\"font-size:21px;font-weight:800;color:#fff;margin-bottom:24px;letter-spacing:-.01em\">VAPT follows a repeatable path<\/div>\n <div style=\"display:grid;grid-template-columns:1fr 1fr 1fr ;gap:16px\"><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><circle cx=\"12\" cy=\"12\" r=\"4.5\"\/><circle cx=\"12\" cy=\"12\" r=\"1.3\" fill=\"currentColor\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Plan and scope<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Define what is tested, how, and the rules of engagement.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><circle cx=\"12\" cy=\"12\" r=\"7\"\/><path d=\"M12 2v4M12 18v4M2 12h4M18 12h4\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Test and exploit<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Scan for weaknesses, then safely prove what is exploitable.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M15 6a4 4 0 0 0-5.5 4.5l-6 6L6 19l6-6A4 4 0 0 0 15 6z\" transform=\"rotate(0 12 12)\"\/><path d=\"M14.5 6.5l2 2\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Report and fix<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Turn findings into prioritised, actionable remediation, then retest.<\/div>\n <\/div><\/div>\n<\/div>\n\n <h2 class=\"sec\" id=\"stages\">The six stages of a VAPT<\/h2>\n <p>While methodologies vary, a thorough VAPT moves through six logical stages, ending with a loop back to verify the fixes.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">The process<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">Six stages from scope to fix<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">A professional VAPT is methodical. Each stage builds on the last, ending not with a list of problems but with fixes proven by a retest.<\/div>\n <svg viewBox=\"0 0 700 260\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The six-stage VAPT process from scoping to remediation and retest\">\n<defs><marker id=\"vp\" markerWidth=\"10\" markerHeight=\"10\" refX=\"6\" refY=\"4\" orient=\"auto\"><path d=\"M0 0 L8 4 L0 8 Z\" fill=\"#5b64c8\"\/><\/marker><\/defs>\n<g font-family=\"Inter,Arial,sans-serif\" text-anchor=\"middle\">\n <g>\n <circle cx=\"115\" cy=\"70\" r=\"30\" fill=\"#1c267a\"\/><text x=\"115\" y=\"76\" fill=\"#fff\" font-size=\"18\" font-weight=\"800\">1<\/text>\n <text x=\"115\" y=\"120\" fill=\"#28304f\" font-size=\"11.5\" font-weight=\"700\">Scope<\/text>\n <circle cx=\"290\" cy=\"70\" r=\"30\" fill=\"#26308f\"\/><text x=\"290\" y=\"76\" fill=\"#fff\" font-size=\"18\" font-weight=\"800\">2<\/text>\n <text x=\"290\" y=\"120\" fill=\"#28304f\" font-size=\"11.5\" font-weight=\"700\">Recon<\/text>\n <circle cx=\"465\" cy=\"70\" r=\"30\" fill=\"#2b3596\"\/><text x=\"465\" y=\"76\" fill=\"#fff\" font-size=\"18\" font-weight=\"800\">3<\/text>\n <text x=\"465\" y=\"120\" fill=\"#28304f\" font-size=\"11.5\" font-weight=\"700\">Scan<\/text>\n <circle cx=\"620\" cy=\"70\" r=\"30\" fill=\"#3a46c0\"\/><text x=\"620\" y=\"76\" fill=\"#fff\" font-size=\"18\" font-weight=\"800\">4<\/text>\n <text x=\"620\" y=\"112\" fill=\"#28304f\" font-size=\"11.5\" font-weight=\"700\">Exploit<\/text>\n <\/g>\n <g stroke=\"#5b64c8\" stroke-width=\"2\">\n <line x1=\"147\" y1=\"70\" x2=\"258\" y2=\"70\" marker-end=\"url(#vp)\"\/>\n <line x1=\"322\" y1=\"70\" x2=\"433\" y2=\"70\" marker-end=\"url(#vp)\"\/>\n <line x1=\"497\" y1=\"70\" x2=\"588\" y2=\"70\" marker-end=\"url(#vp)\"\/>\n <\/g>\n <g>\n <circle cx=\"380\" cy=\"185\" r=\"30\" fill=\"#4954c8\"\/><text x=\"380\" y=\"191\" fill=\"#fff\" font-size=\"18\" font-weight=\"800\">5<\/text>\n <text x=\"380\" y=\"235\" fill=\"#28304f\" font-size=\"11.5\" font-weight=\"700\">Report<\/text>\n <circle cx=\"555\" cy=\"185\" r=\"30\" fill=\"#0a7d6c\"\/><text x=\"555\" y=\"191\" fill=\"#fff\" font-size=\"18\" font-weight=\"800\">6<\/text>\n <text x=\"555\" y=\"227\" fill=\"#28304f\" font-size=\"11.5\" font-weight=\"700\">Remediate<\/text>\n <text x=\"555\" y=\"242\" fill=\"#28304f\" font-size=\"11.5\" font-weight=\"700\">& retest<\/text>\n <\/g>\n <path d=\"M620 100 Q620 185 412 185\" fill=\"none\" stroke=\"#5b64c8\" stroke-width=\"2\" marker-end=\"url(#vp)\"\/>\n <line x1=\"412\" y1=\"185\" x2=\"523\" y2=\"185\" stroke=\"#5b64c8\" stroke-width=\"2\" marker-end=\"url(#vp)\"\/>\n<\/g><\/svg>\n \n<\/div>\n\n <h2 class=\"sec\" id=\"detail\">Each stage explained<\/h2>\n <div class=\"otable\"><table class=\"regtable\">\n <tr><th>Stage<\/th><th>What happens<\/th><\/tr>\n <tr><td><strong>1. Scoping<\/strong><\/td><td>Define targets, depth, approach, and rules of engagement up front<\/td><\/tr>\n <tr><td><strong>2. Reconnaissance<\/strong><\/td><td>Gather information about the targets and map the attack surface<\/td><\/tr>\n <tr><td><strong>3. Scanning<\/strong><\/td><td>Identify weaknesses across the in-scope systems<\/td><\/tr>\n <tr><td><strong>4. Exploitation<\/strong><\/td><td>Safely and deliberately attempt to exploit weaknesses to prove risk<\/td><\/tr>\n <tr><td><strong>5. Analysis and reporting<\/strong><\/td><td>Assess impact, prioritise by severity, and document clear findings<\/td><\/tr>\n <tr><td><strong>6. Remediation and retest<\/strong><\/td><td>Fix the issues, then retest to confirm they are genuinely closed<\/td><\/tr>\n <\/table><\/div>\n\n <div class=\"bbox teal\"><div class=\"bt\">Scoping decides everything<\/div>The first stage quietly determines the value of the whole test. A clear scope, the right targets, the chosen approach, and agreed rules of engagement, ensures the test focuses on real risk and runs safely. Rushing scope is where weak engagements begin.<\/div>\n\n <p>The heart of the engagement is the move from scanning to exploitation. Scanning produces candidates, potential weaknesses. Exploitation is where skilled testers prove which of those are genuinely dangerous by safely demonstrating what an attacker could actually do, including chaining smaller issues into a serious one. That proof is what separates VAPT from a plain assessment.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Controlled, not reckless<\/div>Exploitation in a VAPT is deliberate and safe, testers work within agreed rules of engagement to demonstrate risk without causing damage. The goal is proof of impact, achieved responsibly, not disruption.<\/div>\n\n <h2 class=\"sec\" id=\"retest\">The retest that closes the loop<\/h2>\n <p>A frequently overlooked but critical stage is the retest. After you remediate the reported findings, testers verify that the fixes actually resolved the issues and did not introduce new ones. Without this step, you have a report and some fixes, but no proof they worked. The retest is what turns a VAPT from a snapshot of problems into evidence that your security actually improved, which is exactly what auditors and enterprise buyers want to see.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path through the VAPT process<\/h2>\n <p>Running this full process, scoping, testing, analysis, reporting, remediation tracking, and a retest, is a lot for a lean team to coordinate across separate vendors and tools, especially the follow-through after the report lands. The efficient path is a process that carries findings all the way to a verified fix in one place.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. Its VAPT combines an AI-driven scanner with expert-led testing, then categorises findings by severity, pinpoints affected endpoints, generates remediation reports, and produces retest reports, carrying the whole process to a verified fix on one platform alongside 200+ compliance frameworks. Running the full VAPT loop without stitching vendors together is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Run the whole VAPT loop, through to a verified fix.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Take VAPT from scope to exploitation to remediation and retest, with reports at every step, on one platform. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What are the stages of a VAPT?<\/summary><p>Typically six: scoping and rules of engagement, reconnaissance, scanning for weaknesses, controlled exploitation to prove risk, analysis and reporting, and remediation with a retest to confirm fixes. The sequence takes you from planning to verified improvement.<\/p><\/details>\n <details><summary>What is the difference between scanning and exploitation in a VAPT?<\/summary><p>Scanning identifies potential weaknesses across your systems. Exploitation is where testers safely and deliberately attempt to exploit those weaknesses to prove which are genuinely dangerous and what an attacker could actually achieve. Scanning finds; exploitation proves.<\/p><\/details>\n <details><summary>Is exploitation during a pentest safe?<\/summary><p>Yes, when done professionally. Exploitation is controlled and bound by agreed rules of engagement, designed to demonstrate real risk without causing damage or disruption. The aim is proof of impact achieved responsibly.<\/p><\/details>\n <details><summary>What is a retest in VAPT?<\/summary><p>After you fix the reported findings, testers verify that the fixes actually resolved the issues without introducing new ones. The retest turns a VAPT from a list of problems into evidence that your security genuinely improved, which auditors and buyers value.<\/p><\/details>\n <details><summary>Why is scoping so important in a VAPT?<\/summary><p>Scoping determines what gets tested, how deeply, with which approach, and under what rules. A clear scope focuses the test on real risk and keeps it safe, while a rushed or vague scope is where weak, low-value engagements begin.<\/p><\/details>\n <details><summary>How long does a VAPT take?<\/summary><p>It varies with scope, the number and complexity of targets, and the depth of testing. A focused application test is shorter than a broad, multi-target engagement. Scoping is where the timeline and effort are set, which is another reason it matters.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>The VAPT Process, Step by Step: How a Pentest Works | Osto A professional VAPT is a disciplined sequence, not\u2026<\/p>\n","protected":false},"author":8,"featured_media":931,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[400,181,186,401],"class_list":["post-930","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-penetration-testing-process","tag-vapt","tag-vapt-process","tag-vapt-steps"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/930","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=930"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/930\/revisions"}],"predecessor-version":[{"id":932,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/930\/revisions\/932"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/931"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=930"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=930"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=930"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":930,"date":"2026-08-18T04:20:46","date_gmt":"2026-08-18T04:20:46","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=930"},"modified":"2026-08-18T04:20:46","modified_gmt":"2026-08-18T04:20:46","slug":"vapt-process-steps","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/vapt-process-steps\/","title":{"rendered":"The VAPT Process, Step by Step: How a Pentest Works"},"content":{"rendered":"\n\n\n\n\n\nThe VAPT Process, Step by Step: How a Pentest Works | Osto<\/title>\n<meta name=\"description\" content=\"The VAPT process step by step: scoping, reconnaissance, scanning, controlled exploitation, risk analysis, reporting, and remediation with a retest.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">A professional VAPT is a disciplined sequence, not a single scan. Here is what happens at each stage, from defining scope to proving that your fixes actually worked.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>8 min read<\/span><span class=\"dot\"><\/span><span>Security Testing<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>A VAPT runs through defined stages: scoping and rules of engagement, reconnaissance, scanning to find weaknesses, controlled exploitation to prove real risk, then risk analysis, reporting, and remediation with a retest to confirm fixes.<\/p>\n <p>The value is in the whole sequence. Scanning finds candidates, exploitation proves impact, and the report translates it into prioritised fixes. A good VAPT ends with a retest that verifies the issues are actually closed, not just a document.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#matters\">Why the process matters<\/a><\/li>\n <li><a href=\"#stages\">The six stages<\/a><\/li>\n <li><a href=\"#detail\">Each stage explained<\/a><\/li>\n <li><a href=\"#retest\">The retest that closes the loop<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"matters\">Why the VAPT process matters<\/h2>\n <p>The difference between a genuine VAPT and a superficial scan is the process behind it. A real engagement follows a structured methodology so that nothing important is missed, findings are proven rather than guessed, and the output is something you can act on. Understanding the stages helps you tell a serious test from a checkbox exercise, and helps you get real value from the engagement rather than just a PDF.<\/p>\n\n <div style=\"background:linear-gradient(135deg,#0e1444,#1c267a 55%,#242f86);border-radius:20px;padding:34px 34px 30px;margin:30px 0;box-shadow:0 18px 50px rgba(14,20,68,.28);position:relative;overflow:hidden\">\n <div style=\"position:absolute;top:-50px;right:-40px;width:260px;height:260px;background:radial-gradient(circle,rgba(58,70,192,.45),transparent 68%);pointer-events:none\"><\/div>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#aeb6ee;margin-bottom:6px\">A disciplined sequence<\/div>\n <div style=\"font-size:21px;font-weight:800;color:#fff;margin-bottom:24px;letter-spacing:-.01em\">VAPT follows a repeatable path<\/div>\n <div style=\"display:grid;grid-template-columns:1fr 1fr 1fr ;gap:16px\"><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><circle cx=\"12\" cy=\"12\" r=\"4.5\"\/><circle cx=\"12\" cy=\"12\" r=\"1.3\" fill=\"currentColor\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Plan and scope<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Define what is tested, how, and the rules of engagement.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><circle cx=\"12\" cy=\"12\" r=\"7\"\/><path d=\"M12 2v4M12 18v4M2 12h4M18 12h4\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Test and exploit<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Scan for weaknesses, then safely prove what is exploitable.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M15 6a4 4 0 0 0-5.5 4.5l-6 6L6 19l6-6A4 4 0 0 0 15 6z\" transform=\"rotate(0 12 12)\"\/><path d=\"M14.5 6.5l2 2\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Report and fix<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Turn findings into prioritised, actionable remediation, then retest.<\/div>\n <\/div><\/div>\n<\/div>\n\n <h2 class=\"sec\" id=\"stages\">The six stages of a VAPT<\/h2>\n <p>While methodologies vary, a thorough VAPT moves through six logical stages, ending with a loop back to verify the fixes.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">The process<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">Six stages from scope to fix<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">A professional VAPT is methodical. Each stage builds on the last, ending not with a list of problems but with fixes proven by a retest.<\/div>\n <svg viewBox=\"0 0 700 260\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The six-stage VAPT process from scoping to remediation and retest\">\n<defs><marker id=\"vp\" markerWidth=\"10\" markerHeight=\"10\" refX=\"6\" refY=\"4\" orient=\"auto\"><path d=\"M0 0 L8 4 L0 8 Z\" fill=\"#5b64c8\"\/><\/marker><\/defs>\n<g font-family=\"Inter,Arial,sans-serif\" text-anchor=\"middle\">\n <g>\n <circle cx=\"115\" cy=\"70\" r=\"30\" fill=\"#1c267a\"\/><text x=\"115\" y=\"76\" fill=\"#fff\" font-size=\"18\" font-weight=\"800\">1<\/text>\n <text x=\"115\" y=\"120\" fill=\"#28304f\" font-size=\"11.5\" font-weight=\"700\">Scope<\/text>\n <circle cx=\"290\" cy=\"70\" r=\"30\" fill=\"#26308f\"\/><text x=\"290\" y=\"76\" fill=\"#fff\" font-size=\"18\" font-weight=\"800\">2<\/text>\n <text x=\"290\" y=\"120\" fill=\"#28304f\" font-size=\"11.5\" font-weight=\"700\">Recon<\/text>\n <circle cx=\"465\" cy=\"70\" r=\"30\" fill=\"#2b3596\"\/><text x=\"465\" y=\"76\" fill=\"#fff\" font-size=\"18\" font-weight=\"800\">3<\/text>\n <text x=\"465\" y=\"120\" fill=\"#28304f\" font-size=\"11.5\" font-weight=\"700\">Scan<\/text>\n <circle cx=\"620\" cy=\"70\" r=\"30\" fill=\"#3a46c0\"\/><text x=\"620\" y=\"76\" fill=\"#fff\" font-size=\"18\" font-weight=\"800\">4<\/text>\n <text x=\"620\" y=\"112\" fill=\"#28304f\" font-size=\"11.5\" font-weight=\"700\">Exploit<\/text>\n <\/g>\n <g stroke=\"#5b64c8\" stroke-width=\"2\">\n <line x1=\"147\" y1=\"70\" x2=\"258\" y2=\"70\" marker-end=\"url(#vp)\"\/>\n <line x1=\"322\" y1=\"70\" x2=\"433\" y2=\"70\" marker-end=\"url(#vp)\"\/>\n <line x1=\"497\" y1=\"70\" x2=\"588\" y2=\"70\" marker-end=\"url(#vp)\"\/>\n <\/g>\n <g>\n <circle cx=\"380\" cy=\"185\" r=\"30\" fill=\"#4954c8\"\/><text x=\"380\" y=\"191\" fill=\"#fff\" font-size=\"18\" font-weight=\"800\">5<\/text>\n <text x=\"380\" y=\"235\" fill=\"#28304f\" font-size=\"11.5\" font-weight=\"700\">Report<\/text>\n <circle cx=\"555\" cy=\"185\" r=\"30\" fill=\"#0a7d6c\"\/><text x=\"555\" y=\"191\" fill=\"#fff\" font-size=\"18\" font-weight=\"800\">6<\/text>\n <text x=\"555\" y=\"227\" fill=\"#28304f\" font-size=\"11.5\" font-weight=\"700\">Remediate<\/text>\n <text x=\"555\" y=\"242\" fill=\"#28304f\" font-size=\"11.5\" font-weight=\"700\">& retest<\/text>\n <\/g>\n <path d=\"M620 100 Q620 185 412 185\" fill=\"none\" stroke=\"#5b64c8\" stroke-width=\"2\" marker-end=\"url(#vp)\"\/>\n <line x1=\"412\" y1=\"185\" x2=\"523\" y2=\"185\" stroke=\"#5b64c8\" stroke-width=\"2\" marker-end=\"url(#vp)\"\/>\n<\/g><\/svg>\n \n<\/div>\n\n <h2 class=\"sec\" id=\"detail\">Each stage explained<\/h2>\n <div class=\"otable\"><table class=\"regtable\">\n <tr><th>Stage<\/th><th>What happens<\/th><\/tr>\n <tr><td><strong>1. Scoping<\/strong><\/td><td>Define targets, depth, approach, and rules of engagement up front<\/td><\/tr>\n <tr><td><strong>2. Reconnaissance<\/strong><\/td><td>Gather information about the targets and map the attack surface<\/td><\/tr>\n <tr><td><strong>3. Scanning<\/strong><\/td><td>Identify weaknesses across the in-scope systems<\/td><\/tr>\n <tr><td><strong>4. Exploitation<\/strong><\/td><td>Safely and deliberately attempt to exploit weaknesses to prove risk<\/td><\/tr>\n <tr><td><strong>5. Analysis and reporting<\/strong><\/td><td>Assess impact, prioritise by severity, and document clear findings<\/td><\/tr>\n <tr><td><strong>6. Remediation and retest<\/strong><\/td><td>Fix the issues, then retest to confirm they are genuinely closed<\/td><\/tr>\n <\/table><\/div>\n\n <div class=\"bbox teal\"><div class=\"bt\">Scoping decides everything<\/div>The first stage quietly determines the value of the whole test. A clear scope, the right targets, the chosen approach, and agreed rules of engagement, ensures the test focuses on real risk and runs safely. Rushing scope is where weak engagements begin.<\/div>\n\n <p>The heart of the engagement is the move from scanning to exploitation. Scanning produces candidates, potential weaknesses. Exploitation is where skilled testers prove which of those are genuinely dangerous by safely demonstrating what an attacker could actually do, including chaining smaller issues into a serious one. That proof is what separates VAPT from a plain assessment.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Controlled, not reckless<\/div>Exploitation in a VAPT is deliberate and safe, testers work within agreed rules of engagement to demonstrate risk without causing damage. The goal is proof of impact, achieved responsibly, not disruption.<\/div>\n\n <h2 class=\"sec\" id=\"retest\">The retest that closes the loop<\/h2>\n <p>A frequently overlooked but critical stage is the retest. After you remediate the reported findings, testers verify that the fixes actually resolved the issues and did not introduce new ones. Without this step, you have a report and some fixes, but no proof they worked. The retest is what turns a VAPT from a snapshot of problems into evidence that your security actually improved, which is exactly what auditors and enterprise buyers want to see.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path through the VAPT process<\/h2>\n <p>Running this full process, scoping, testing, analysis, reporting, remediation tracking, and a retest, is a lot for a lean team to coordinate across separate vendors and tools, especially the follow-through after the report lands. The efficient path is a process that carries findings all the way to a verified fix in one place.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. Its VAPT combines an AI-driven scanner with expert-led testing, then categorises findings by severity, pinpoints affected endpoints, generates remediation reports, and produces retest reports, carrying the whole process to a verified fix on one platform alongside 200+ compliance frameworks. Running the full VAPT loop without stitching vendors together is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Run the whole VAPT loop, through to a verified fix.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Take VAPT from scope to exploitation to remediation and retest, with reports at every step, on one platform. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What are the stages of a VAPT?<\/summary><p>Typically six: scoping and rules of engagement, reconnaissance, scanning for weaknesses, controlled exploitation to prove risk, analysis and reporting, and remediation with a retest to confirm fixes. The sequence takes you from planning to verified improvement.<\/p><\/details>\n <details><summary>What is the difference between scanning and exploitation in a VAPT?<\/summary><p>Scanning identifies potential weaknesses across your systems. Exploitation is where testers safely and deliberately attempt to exploit those weaknesses to prove which are genuinely dangerous and what an attacker could actually achieve. Scanning finds; exploitation proves.<\/p><\/details>\n <details><summary>Is exploitation during a pentest safe?<\/summary><p>Yes, when done professionally. Exploitation is controlled and bound by agreed rules of engagement, designed to demonstrate real risk without causing damage or disruption. The aim is proof of impact achieved responsibly.<\/p><\/details>\n <details><summary>What is a retest in VAPT?<\/summary><p>After you fix the reported findings, testers verify that the fixes actually resolved the issues without introducing new ones. The retest turns a VAPT from a list of problems into evidence that your security genuinely improved, which auditors and buyers value.<\/p><\/details>\n <details><summary>Why is scoping so important in a VAPT?<\/summary><p>Scoping determines what gets tested, how deeply, with which approach, and under what rules. A clear scope focuses the test on real risk and keeps it safe, while a rushed or vague scope is where weak, low-value engagements begin.<\/p><\/details>\n <details><summary>How long does a VAPT take?<\/summary><p>It varies with scope, the number and complexity of targets, and the depth of testing. A focused application test is shorter than a broad, multi-target engagement. Scoping is where the timeline and effort are set, which is another reason it matters.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>The VAPT Process, Step by Step: How a Pentest Works | Osto A professional VAPT is a disciplined sequence, not\u2026<\/p>\n","protected":false},"author":8,"featured_media":931,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[400,181,186,401],"class_list":["post-930","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-penetration-testing-process","tag-vapt","tag-vapt-process","tag-vapt-steps"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/930","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=930"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/930\/revisions"}],"predecessor-version":[{"id":932,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/930\/revisions\/932"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/931"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=930"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=930"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=930"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}